UniPAY Payment Gateway CVE-2026-103331

The specific prerequisite is a default or misconfigured installation where the UniPAY merchant secret used to sign/verify payment notifications is left empty - the description states this is the default, so default configurations are exploitable. Exploitation targets the plugin's payment-notification (callback) handling: an attacker must be able to reach that endpoint over the network and submit a forged notification referencing an order. Limiting factors: the store must actually use the UniPAY Payment Gateway For WooCommerce plugin (version through 2.3); a merchant who has configured a non-empty secret would break the trivial-signature bypass; and impact is limited to falsifying order payment status (integrity), not data disclosure or site availability. No authentication and no user interaction are required (PR:N/UI:N).

Signals are consistent and point to a moderate, not emergency, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms a remote, unauthenticated, low-complexity attack requiring no user interaction, matching the description's claim that the signature is validated against a merchant secret that is empty by default - so default installations are exploitable without any credential. However, impact is scoped narrowly: C:N/A:N with only I:L, reflecting that the attacker can forge payment notifications to mark orders paid but cannot read data, execute code, or disrupt availability. EPSS is low (0.15%, 4th percentile), the vulnerability is NOT on CISA KEV, and no public exploit is identified, so there is no evidence of active or imminent widespread exploitation. The vuln.today decision label is 'this_month,' aligning with a plan-and-patch cadence rather than act_now/emergency. The main caveat: the real-world business impact (fraudulent free orders / revenue loss for affected merchants) can exceed what a 5.3/I:L base score suggests, so operators running this gateway should weight financial-fraud risk above the raw score. No key signals conflict here.

An unauthenticated attacker places an order on a WooCommerce store using the UniPAY gateway, then sends a crafted payment-notification callback to the plugin's notification endpoint. Because the notification signature is verified against a merchant secret that is empty by default, the attacker computes a 'valid' signature and the plugin marks the order as paid without any real payment. No public exploit code is identified at time of analysis, and the low complexity (AC:L) means no special timing or heap conditions are required.